Specification-based anomaly detection: a new approach for detecting network intrusions

By R. Sekar, Ajay K. Gupta, J. Frullo, T. Shanbhag, A. Tiwari, H. Yang, S. Zhou. Conference on Computer and Communications Security, 2002

487 citations recorded by the source corpus.

Subfields: Artificial Intelligence, Computer Networks and Communications, Signal Processing

View Paper: https://www.semanticscholar.org/paper/fe04438184800230074ca343785da8985682d6c9

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

1. Salvatore J. Stolfo
2. Andrew J. Clark
3. Jonathan J. Davis
4. Pavel Laskov
5. Ke Wang
6. Vipin Kumar
7. Arindam Banerjee
8. Varun Chandola

In Computer Networks and Communications

1. Salvatore J. Stolfo
2. Andrew J. Clark
3. Jonathan J. Davis
4. Pavel Laskov
5. Ke Wang
6. Konrad Rieck
7. Vipin Kumar
8. Varun Chandola

In Signal Processing

1. Pavel Laskov
2. Salvatore J. Stolfo
3. Vipin Kumar
4. Arindam Banerjee
5. Varun Chandola
6. Ke Wang
7. Gabriel Maciá-Fernández
8. Pedro Garcia-Teodoro

Citations in the corpus

• A Survey of Malware Detection Techniques (2007, methodology): “[44] consider that their detection method as both specificationbased and anomaly-based, given how we have defined specification-based and anomalybased detection in this report, this method would be more aptly named “A Model-based Approach to Anomaly Detection.”
• Anomaly-based network intrusion detection: Techniques, systems and challenges (2009, background): “Their main drawback is that the development of high-quality knowledge is often difficult and time-consuming (Sekar et al., 2002).”
• Anomaly detection: A survey (2009, methodology): “FSA have been used to detect anomalies in network protocol data [Sekar et al. 2002; Sekar et al. 1999].”
• Anagram: A Content Anomaly Detector Resistant to Mimicry Attack (2006, methodology): “, [5-8]) have focused on payload-based anomaly detection.”
• DÏoT: A Federated Self-learning Anomaly Detection System for IoT (2018, background): “Some works have proposed, as we do, to model communication as a language [42], [43].”
• An Analysis of the 1999 DARPA/Lincoln Laboratory Evaluation Data for Network Anomaly Detection (2003, methodology): “These sets have been used to test a number of important systems [4] [6] [7] [12] [16] [18] [20] [21] [22] [24] [30] [32] [33] [34] [35] [36] [37].”
• Using Model-based Intrusion Detection for SCADA Networks (2006, unknown): “For example, Sekar et al. [9] combine specification-based with statistical anomaly detection techniques to ease the task of model construction and to reduce false alarm rate.”
• Data preprocessing for anomaly based network intrusion detection: A review (2011, methodology): “Amodel of TCP / IP tra ffi c was created by encoding information from the RFCs into state machines (Sekar et al., 2002).”